CVE-2026-106078: Veeam Veeam Backup for Microsoft 365 vulnerability
A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker must be able to forge a federation token and send requests to the affected REST API. No authentication is required once the forged token is used.
Which REST API endpoints are exposed?
The issue affects REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service. The provided information does not identify specific endpoint paths.
Can this vulnerability be used to access the backup service itself?
The described impact is limited to REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service. The provided information does not state that backup-service endpoints can be accessed through this bypass.